Windows sysinternals

Chapter 14 System Information Utilities 353
The page lists shown on the Use Counts tab are
■ Active Memory that is immediately available for use without incurring a fault. This
includes memory that is in the working set of one or more processes or one of the
system working sets (such as the system cache working set), as well as nonpageable
memory such as nonpaged pool and Address Windowing Extension (AWE) allocations.
■ Standby Cached memory that has been removed from a working set but that can be
soft-faulted back into active memory. It can be repurposed without incurring a disk I/O.
■ Modified Memory that has been removed from a working set and that was modified
while in use but has not yet been written to disk. It can be soft-faulted back into the
working set from which it had been removed, but it must otherwise be written to disk
before it can be reused.
■ Modified no write The same as Modified, except that the page has been marked at
the request of file system drivers not to be automatically written to disk—for example,
with NTFS transaction logging.
■ Transition A temporary state for a page that has been locked into memory by a driver
to perform an I/O to or from it.
■ Zeroed Memory that has been initialized to all zeros and that is available for
allocation.
■ Free Memory that is not in use and has not been initialized to zeros. Free memory is
available for kernel allocation or for user-mode allocation if initialized from a disk read.
If necessary, the memory manager can zero pages from the free list before giving them
to a user process. The zero page thread, which runs at lower priority than all other
threads, fills free pages with zeros and moves them to the Zeroed list, which is why
there are typically very few pages on this list.
■ Bad Memory that has generated parity or other hardware errors and cannot be used.
The Bad list is also used by Windows for pages transitioning from one state to another
or are on internal look-aside lists.
The memory allocation types shown in the table’s rows are
■ Process Private Memory that can be used only by a single process.
■ Mapped File Shareable memory that represents a file on disk. Executable images and
resource DLLs are examples of mapped files.
■ Shared Memory Memory that can be shared by multiple processes and that can be
paged out to a paging file.
■ Page Table Kernel-mode memory that describes processes’ virtual address spaces.
■ Paged Pool Kernel-allocated memory that can be paged out to disk.
■ Nonpaged Pool Kernel-allocated memory that must always remain in physical
memory. Nonpaged pool is always represented only in the Active column.
www.it-ebooks.info